Slashdot Mirror
AOL Security Compromised by Teenager
Freaky_Friday wrote with a link to an InfoWorld article about a teenage kid accessing customer information at AOL. The alleged criminal trespass began late last year, and extended up through early April. According to the article, the guy used some 'off-the-shelf' hacking software he downloaded online to gain access to, and then transmit information from, AOL's systems. "The complaint states that Nieves admitted to investigators that he committed the alleged acts because AOL took away his accounts. 'I accessed their internal accounts and their network and used it to try to get my accounts back,' the defendant is quoted as saying in the complaint. He also admitted to posting photos of his exploits in a photo Web site, according to the complaint ... If the defendant was honest about his motivation in his reported confession, it's safe to assume that he wasn't interested in stealing data for financial gain, [Managing director of technology at FTI Consulting Mark] Rasch said. Still, it'll be interesting to find out what steps AOL is taking if customer data was in fact compromised, he said."
Kid must be pretty smart if he was able to hack AOL's servers. *Reads article* Ohhhhh to get his account back...hmm forget it.
I mean I won't even go with the obvious AOL bashing. But is it really news that Teens are committing computer crime? Isn't that the stereotype? The pimple faced dateless wonder in his parents basement 'pwning' the 'g1bs0n'?
Happy Noodle Boy says "F###ing doughnut! Mock me? You fried cyclops!!"
I've never heard of AOL software referred to like that before. Sure I was thinking it.
I, for one, would like to know why he lost his original AOL accounts in the first place.
;)
Hacking, maybe?
ScottKin
I don't give a rat's behind about "karma" here or anywhere else. Don't like what I have to say here? Deal with it!
I tried to hack someone once but that damn 127.0.0.1 was behind a firewall and it just messed up my computers
Nah, they'd rather squeeze some change out of him.
No, we need kids who don't go getting their accounts cancelled then break the law trying to get them back. We need kids who think up positive creative solutions to problems and aren't malcontents. He *should* face criminal charges. If he was banned wrongly there are other avenues to pursue. Not punishing him would just encourage others to do the same type of thing.
If only it worked that way...
In high school I was 'banned' (really they revoked my account... problem is they left the Administrator account without a password on the local system -- idiots) from using the schools computers because I had ssh'd into my home system and was fiddling around. Obviously because there was a command line involved, I was 'hacking.'
If he had internet access already, why on earth would want an AOL account? Just a schtoopidttt script kiddie...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Mike aka Virus is far misrepresented by this article and the (at least) two others about this. AOL did not track him down by themselves, he was snitched on by a fellow member in the 'aim scene'. Causing $500,000 in damage by logging onto internal and overhead accounts to suspend and unsuspend account, way to try to make a case for yourself AOL. If anyone in this case needs to get in trouble it is AOL. AOL completely fails to train their employees against social engineering techniques, therefore their own employees are really the ones accountable for any customer information being revealed. AOL is notorious for exchanging favors for information on exploits and snitching on your "friends".
To quote the article:
"AOL has had pretty good security over the years."
This is a massive error in any credibility on AOL's part. Within the past 6 months there have been countless exploits in their systems including the ability to register accounts that were 1 or 2 characters long, register accounts of names that were already in use, including over registering internal accounts and accounts such as "AOL System Msg", the ability to register accounts with vulgar and racist words in them via non-American AOL sites, and thats just to name a few off the top of my head. Currently there is still a major issue with accounts having more than one working password.
I could go on and on about the flaws of AOL, but why bother, they know that the flaws exist but instead of tying to fix them they bury them by going after the people who find them, and leaving the holes still in their systems.
If security is this bad is it too off the wall to suggest that this may have been done before by people who have it in their best interests to keep quiet about it? Scary stuff.
In Related News. AOL is looking for a software engineers and it people to combat a variety or threats to its systems and users. They use many Open Source projects and a variety of exciting opportunities just opened up.
ohhh. Been there, done that. NCSA telnet on an old skewl mac to my box at home on dialup. Monilith dynamic dns. Except I was "Playing games" not hacking. Sadly, that teacher is still teaching Claris works or some crap like that while I manage the ISP division of a Telco/CatTV/ISP. *yawn*
Can all fish swim?
On top of that, lets have AOL users now hold the board of AOL responsible until they show they have fixed their security issues. If a 'teenage kid' can hack their security, why should any AOL user remain with them? If they fail the post remediation testing, penalize them financially.
Support NYCountryLawyer RIAA vs People
I guess you missed the part where it said "off the shelf hacking software"
Just because you can click yes all the way through installing something on Windows doesn't mean the NSA should hire you to harden the Linux or BSD kernels they use on their systems...
He might have been ratted out by his hacking crew, but he deserved it. He is a jerk, special ed all his life for anger issues. And it wasn't just AOL, so that BS about "just trying to get my account" back doesn't fly. The jackass was so freaking high on himself that he would use social engineering to gain access to companies databases, then send screen caps to the FBI. Including his aim handle. Which he also had on his myspace page. Dumbass.
"AOL pwn3d by script kiddie. World laughs (harder)."
In what bizarro world does AOL have good customer service, such that they'd investigate and remove a ban?
What are these other avenues?
A civil lawsuit?
[Fuck Beta]
o0t!
Steve Jobs was a script kiddie? O rly?
I was in high school from 95-99, so the internet revolution/everybody having a computer thing went from just getting going to the beginnings of big time. Almost every single time I mentioned I was into computers to anyone, the first question was always "Are you a hacker?". Anytime I did anything other than load Word, Solitaire, or Netscape, someone would ask me "Are you hacking?". It all got old very quickly. I used to prefer an auto-hiding taskbar, and they almost permanently banned me from the library computers for "hacking" when I turned it on for the hour or so I had alloted to me at the time. As it was, I kept their computers running pretty much single-handedly (county IT dept was useless, and the only other student that was at all techy like me had already screwed up his chances by using his access to steal teacher/student private information) so I wasn't too worried about getting banned.
:)
Incidentally, they were all Windows 95 boxes with some pretty bad security software on it. I found at least two ways through it - the fun one was they didn't lock down Winkey-F. Search on the program you wanted to run, and run it. Likewise, you could load an "approved" program, pull up the Open File dialog, and find the program in there and run it. The other way was Winkey-E. It would pop up a "You don't have permission to run this program" error. Hold it down and the screen filled with them very quickly. Eventually, Windows ran out of memory, Explorer crashed, and it would automatically repop without the security software there. Voila.
So, I guess I was kind of a hacker. Oh well
What is this AOL you speak of?
Read the EFF's Fair Use FAQ
Who DIDN'T own AOL when they were a teenager?
The latest Slashdot meme.
If he was banned wrongly there are other avenues to pursue.
Save switching ISPs, not really. AOL's support is pretty bad. For example mail to aol wouldn't parce out names with periods in them.... I.e. John E. Hancock.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
you're new here aren't you. (:
Quack, quack.
You make it sound as if they had a clue. These are just a few k1dd13z doing the kind of shit which only k1dd3z do.
They believe that they're "special" because they did it, all the while not realising that anybody can do it, but it's just that only retarded k1ddi3z are actually bored enough, or have the time to waste to do something as lame and loserish as "hack" AOL.
Other shocking headlines: "Ape defeats security of Diebold voting machines"
My high school had windows 95 machines that were imaged from a server on a regular basis, so I had no qualms about pointing out security problems by placing notes in C:\ and after a month with no change to security, I'd format the box.
They started running Fortress but you could still open up apps like Word and get to the system information tool where you could run other applications from- similar with netscape- just configure a helper application for some odd protocol and try and go to a site with that protocol and bam your program runs.
I also discovered a loophole with their digital card catalog system (green screen terminals) that allowed me to outdial from their interlibrary connection system. I don't remember the exact mechanism, but if I had to guess, I think I let it dial the other library, then just did +++ATH0 and then dialed to wherever I wanted to dial. I think I only used it to dial up my local shell account (local call)- in theory, though, I could have called anywhere, I don't think they had it hooked to the PBX.
Anyway, I didn't count myself a hacker, but I did find a couple ways to end run their security so I could do day-to-day (for me, ~1996) things like check email that nobody else really did.
I both hated and loved high school.
Last year (my final year of school) I found that if you yanked out the network cable when it said "applying security settings", it wouldn't apply the group policy. It was rather handy, because one of the things we had disabled was right clicking... nearly drove me mad that did...
I didn't say that Steve Jobs was a script kiddie. What I said was that we shouldn't just stamp out the spark in this kid by sending him to jail or even charging him with a crime. Society is made far better when brilliance is recognized and properly used, i.e. for tasks that are legal. And for those of you who voted me a troll, fuck you, o knuckle dragging cavemen.
From the perspective of someone who was in that scene more than a decade ago, it's enlightening to see how much of this is still going on. I don't see where in the article it says he used "'off-the-shelf' hacking software," but I guess these days it doesn't take much talent.
:)
I remember when the phishing trend started. AOL's biggest mistake at that point was creating a special People Connection lobby that overhead/internal accounts would default to. Initially, it was just a private room whose name changed occasionally (who else remembers THEBLIMPSAIDITALL, and numerous incarnations of IllIlIIlIIlllIlIIlI...?). Anyone who knew the name could get into the room with any regular account, and phish privileged accounts to their heart's content. Eventually AOL made some progress and created a viewruled lobby, which they assumed would keep the riff-raff out, but they forgot to plan for the fact that the riff-raff already had access to privileged accounts.
In the early to mid 90s, there was no such thing as phishing. If you wanted privileged access, you had to work for it, and it was a thankless (but sometimes rewarding) task. There were a handful of folks - okay, probably a few handfuls, maybe numbering in the tens - who spent their free time doing real hacking. Those of us on the Mac side were busy poring over logs from Serial of Champions, reverse engineering the client-server communications. Through trial and error, we determined that every client request would send a two-character "token" and an argument to match. For example, double-clicking a message board to open it up might send the token "mB" with the message board's ID as the argument. Using the Keyword feature would send a Kk token, that's the only one I still remember for sure.
We eventually compiled a list of the various "tokens" that made up the AOL protocol, and what they did. There was a developer's client extension that allowed for sending arbitrary token/args, and like most things inhouse, it was leaked to a few people. This gave some of us the ability to do things nobody else could. Way before AOL ever introduced "Mail Controls," for instance, we were able to reject mail from specified users. The feature had been built into the system from the beginning but had never been released to the public (IIRC, the then-system-devs didn't even know it was possible). We'd stumbled upon the feature by sending random tokens to the server.
Here's a funny story about how something went from blackhat to implemented feature. At some point I discovered a token that would refresh the client's installed list of screen names. Basically, if you had AOL installed on multiple computers, or had multiple copies of the client on one machine, the list of your available screen names would inevitably become outdated across clients: if you created a new screen name on one client, then switched to another, the new name wouldn't show as a sign-on option. Likewise, if you deleted a screen name while you were logged in from one machine, that name would still (incorrectly) display as available on another machine. There was no way to synch up the list of names, so if you created screen name FoobarMan on machine A, the only way to sign onto it from machine B was to reinstall the client.
Well, I found out that if you sent a certain token to the server, it would force a client-side refresh of the screen names on the sign-on list. Having legitimate access to publish things - did I mention I was not only a haxx0r, but also remote staff - I created a little form with a link that would send that token, thus refreshing the client's list of screen names. I passed it on to a TechLive friend who started giving it out to members who were having this (common) problem. Eventually someone inhouse got wind of it. I got reamed, my creation was removed, and a month later a shiny new feature appeared at keyword: NAMES... "Refresh Screen Name List."
Go figure.
Accessing member information is hardly anything new. AOL has a customer management system
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
you know, if I had mod points I would throw some your way. Yeah he needs to be punished, but I think a fine line between punishment & use of his knowledge would be fine. Alienating people doesn't seem like such a good idea. Maybe put him in sort of community service type of position where he can see a benefit when actually contributing as opposed to just wreaking havok. But my whole opinion really hangs on his reasons for doing what he did. if his intent was as he says, why not try to bring him into the fold? Not without some penance of course...
-those people who tell you not to take chances, they are all missing what lifes' all about-
So easy to hack, no wonder it was done.
(easy pun, doh!)
A year or so ago, a relative had their credit card details "lifted" while conducting a transaction over the phone with $retailer. This only became obvious when his monthly credit card statement showed payments to AOL. He called the credit card company to get the payments stopped and refunded. This took place but AOL continued to take the payments. The police were asked to intervene, but even though AOL must have had an address linked to the card details (AOL accounts require a landline don't they ?) they claimed that they couldn't say which account the credit card details were linked to, and refused to help any further. So, more digging by the police eventually found the original culprit had been working telesales at $retailer (strangely enough he no longer worked there and the police were "unable" to give out his details).
Fast forward to this year, and I got charges showing to AOL on my statements. As I have not used AOL for over 10 years (OK, I was a newbie and it seemed better than Compuserve) I was a bit annoyed. Got the charges reversed and asked for the account linked to my card to be canceled. AOL basically said (once again) sorry, we can't do that because we don't know who the card details are linked to. Next month arrives, AOLs payment disappears from my account. I call the bank again and get the charges refunded and ask them to make sure that AOL doesn't get to bill me again. They suggest that I call AOL to sort it out. So, after 45 minutes on hold, I get to talk to a call centre goon, who after much personal digging of my identity, tells me the only way to get the charges canceled is for me to send copies of relevant bank statements and identity documents and credit card numbers to their operations centre in the Netherlands.
Yeah right !
I'm trying to stop a fraud, not propagate another one ! Needless to say, I didn't send those details, and fortunately the bank now seems to have prevented the charges from re-occurring.
In conclusion, FUCK YOU AOL
So much for AOL's security ad campaign...
I got banned from school computers for the last three quarters of my high school career for FTPing some papers I wrote to my personal website so I wouldn't have to find a floppy (Didn't have a USB drive at the time; too cheap to buy one) to revise them at home. I even explained what I was doing, and they had a small "meeting" while I finished up, without even going across the hall and grabbing the school's IT guys for a second opinion. Their conclusion? I was trying to upload a virus to the network. Apparently that's what you do in Microsoft Word these days.
There aren't enough facts available to judge whether AOL could have done more to prevent the alleged intrusion. "We'll learn more as the case goes on," he said. "AOL has had pretty good security over the years." Mark Rasch is a smart guy, but I will have to respectfully disagree with his last quote there. I think if you ask a number of the people coming out of the woodwork to post here, they will agree with my above statements and mirror my disagreement here. Unfortunately it is not too hard to go look and see from web postings how poor AOL's security really is. You will find screen shots from AOL employees programs with all kinds of customer account detail to include Screen Names, Name, Address, Phone Number, last four digits of payment method, and more. Talk about a lack of privacy.
No wonder it's #1!!!
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
If he was doing it with script kiddie stuff then how many other "pros" are doing it and not getting caught?
Has anyone seen a lawsuit where an user can sue AOL or some other corp for not adequately protecting their info? If it can be proven that the exploit was a known exploit then it seems to follow you could sue them for not protecting the info.
"If any question why we died, Tell them because our fathers lied."
If this kid is such a "hacker" why the hell is he using AOL?
There is more to science than physics!
www.iomalfunction.blogspot.com
Why isn't this tagged 'pwnt'?
I think everyone 0wn3d AOL to some degree back then. I remember watching a friend use a CC# generator to make up fake credit cards and register fake AOL accounts. And using some weird Mac utility to hide his porno in various random folders (inside some game folder, I think, with either saves or game files or something).
Funny thing was, it took me a few more years to comprehend what I saw him doing at the time, but I did enjoy reading his books on all the screwball things you could do with Apple computers. I liked making invisible folders with spaces for a name (or giving them names and using them to spell out silly messages).
Heh, that brings back old memories...
There seems to be a fine balance between the need for companies to gather customer data, so they better understand their needs and tailor the user experience, and the possible risks with collecting and managing all of that information. It can be pretty tricky for organizations to convince customers that the collection of data is ultimately a mutually beneficial exercise. I just saw a cool VOD of the CIO of Circuit City and Tom Ridge (ex-Secretary of Homeland Security) talk about how the government and the corporate world deal with thee issues. Check it out at www.cioleadershipforum.com